CVE-2026-70188 is a critical HTTP request smuggling vulnerability in Microsoft ASP.NET Core 10.0 and other versions. It arises from inconsistent interpretation of HTTP requests, allowing an unauthorized attacker to bypass security features over a network. The vulnerability affects multiple versions of ASP.NET Core and has been officially fixed in specific releases.
Squid versions from 3.3.0.1 up to but not including 7.6 are vulnerable to an HTTP Request Smuggling attack due to improper handling of the Transfer-Encoding header. This flaw allows a trusted client to bypass security mechanisms by exploiting HTTP/1.1 Transfer-Encoding parsing. The vulnerability also enables poisoning of upstream HTTP caches, potentially delivering malicious content to other clients. The issue is fixed in Squid version 7.6.
CVE-2026-94439 is a high-severity vulnerability in the Go standard library net/http package involving inconsistent handling of HTTP/1 CONNECT requests. When a server handler sends a 2xx response to such a request but does not hijack the connection, it incorrectly continues to process the connection as HTTP rather than as a tunnel. This behavior can lead to HTTP request smuggling, where intermediaries and the server have differing interpretations of the connection data.
CVE-2026-78660 is a high-severity vulnerability in the Go standard library net/http package involving inconsistent interpretation of HTTP requests, leading to HTTP response smuggling. The issue arises because the HTTP/2 implementation in net/http is lax about malformed framing-related headers, which can be forwarded to HTTP/1 clients when acting as a reverse proxy. If the HTTP/1 client also does not strictly validate these headers, response smuggling can occur.
CVE-2026-56866 is a high-severity vulnerability in the Go standard library net/http package involving inconsistent interpretation of HTTP/1 CONNECT requests with non-empty bodies. When http.Transport sends such a CONNECT request, it writes the body without framing after headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, the connection is returned to the idle pool while the server may interpret trailing body bytes as a new pipelined HTTP/1.1 request. This desynchronization can cause response poisoning in reverse proxies that share the Transport, leading to cross-user response contamination.
CVE-2026-77803 is a low-severity vulnerability in Progress® Telerik® Fiddler® Classic for Windows versions prior to 6.0.20262.10021. It involves inconsistent interpretation of HTTP requests in the proxy request forwarding component, allowing a local low-privilege user to cause a single malformed HTTP request to be split into two requests forwarded to the origin server. This can result in an additional smuggled response without requiring a vulnerable server.
CVE-2026-77802 is a medium severity vulnerability in Progress® Telerik® Fiddler® Classic for Windows prior to version 6.0.20262.10021. It involves HTTP request smuggling due to inconsistent handling of multiple conflicting Content-Length headers in the proxy request forwarding component. A local attacker with low privileges can exploit this to smuggle additional requests against non-RFC-9110-compliant origin servers that keep connections alive. This can lead to response poisoning and unauthorized access to responses intended for other users.
CVE-2026-63718 is a high-severity HTTP Request/Response Smuggling vulnerability in Apache HTTP Server affecting versions 2.4.30 through 2.4.68. It arises from inconsistent interpretation of HTTP requests via the mod_proxy_uwsgi module when processing crafted uwsgi responses with Transfer-Encoding headers.
CVE-2026-94194 is a medium severity vulnerability in the elixir-mint mint HTTP client library. It involves inconsistent interpretation of HTTP/1 responses, specifically in handling Transfer-Encoding headers with multiple codings and connection persistence after HTTP/1.0 responses. This can lead to HTTP request/response smuggling where a malicious HTTP/1 server desynchronizes an intermediary and the Mint client on a pooled connection, causing response poisoning for subsequent requests sharing the connection.
CVE-2026-88773 is a critical vulnerability in Citrix NetScaler ADC and Gateway involving inconsistent interpretation of HTTP requests, known as HTTP Request/Response smuggling. This flaw affects multiple versions of the ADC and Gateway products prior to specific fixed releases. The vulnerability has a high CVSS 4.0 score of 9.3, indicating a severe risk. No known exploits are reported in the wild. The issue can lead to significant impact due to the nature of HTTP request smuggling attacks.
CVE-2026-86350 is a critical vulnerability in Apache Tomcat involving inconsistent interpretation of HTTP/2 requests, leading to HTTP Request/Response smuggling. This flaw is a regression from a previous fix (CVE-2026-41293) and can cause request header mix-ups. It affects Apache Tomcat versions 9.0.118 through 9.0.121, 10.1.55 through 10.1.59, and 11.0.22 through 11.0.25. Upgrading to versions 9.0.122, 10.1.60, or 11.0.26 resolves the issue.
CVE-2026-77756 is a medium severity vulnerability in Apache Tomcat involving inconsistent interpretation of HTTP requests, specifically HTTP Request/Response Smuggling. The issue arises from how the transfer-encoding header is processed for HTTP/1.0 requests when Tomcat is behind a reverse proxy, potentially causing one user's request to fail due to another user's request. Affected versions include Apache Tomcat 8.5.67 through 8.5.100, 9.0.47 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25. Users are advised to upgrade to fixed versions 8.5.101 or later, 9.0.122 or later, 10.1.60 or later, or 11.0.26 or later to remediate the issue.
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep-alive HTTP/1.1 upstream, and returns the socket to the shared pool while the smuggled response remains queued. A different downstream client can then receive the attacker's response. The relevant scope boundary is that webSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection set to 1 are not affected by the demonstrated path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection.
Mint.HTTP1.Parse.chunk_size/1 in lib/mint/http1/parse.ex stops at the first non-hexadecimal byte of a chunked response's chunk-size line and returns the remainder unexamined. Mint.HTTP1.decode_body/5 in lib/mint/http1.ex then discards every byte up to the CRLF with Parse.ignore_until_crlf/1, so the accepted grammar is a run of hex digits followed by arbitrary bytes, where RFC 9112 permits only a ;-introduced chunk extension. Lines such as 5ZZZZZ and 5 9 are accepted as chunk size 5, and 0ZZZZ is accepted as the terminating chunk that ends the message body. An RFC-strict intermediary rejects such a line while Mint accepts it, so the two disagree on chunk boundaries and on where the response ends.
This issue affects mint: from 0.1.0 before 1.10.1.
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability (CVE-2026-11722). This vulnerability allows an attacker to interfere with HTTP request processing, potentially impacting confidentiality and integrity. The issue has a medium severity rating with a CVSS score of 4.8. No specific affected versions or patch information are provided in the available data.
IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers. This vulnerability can lead to a high impact on confidentiality and a low impact on integrity, without affecting availability. The CVSS score is 6.5, indicating medium severity. No specific affected versions or patch information are provided.
IBM WebSphere Application Server and WebSphere Application Server Liberty have a medium severity HTTP request smuggling vulnerability (CVE-2026-11548). This flaw could allow an attacker to interfere with HTTP request processing, impacting confidentiality and integrity but not availability. No affected versions or patch information are provided, and no known exploits exist in the wild at this time.
CVE-2026-93574 is a medium severity vulnerability in the netty-codec-http component used by Red Hat build of Quarkus 3.27.5.SP2. It allows HTTP request smuggling due to improper parsing of HTTP/1.1 chunk-size tokens containing post-digit whitespace. This flaw can be exploited remotely to bypass security controls or access unauthorized resources in proxy or backend deployments. Red Hat has released security advisories addressing this issue in later versions.